1. Field
The present invention relates generally to cryptography and, more specifically, to deterring attacks based at least in part on observing cryptographic computations in a processing system.
2. Description
Public key cryptography is well-known and widely used today. In public key cryptography, each user has a public key and a private key. The public key is made public, while the private key remains secret. Encryption is performed with the public key, while decryption is done with the private key.
The most popular form of public key cryptography today is the Rivest, Shamir, Adleman (RSA) public key cryptosystem. Key generation in the RSA algorithm works as follows: take two large primes, p and q, and compute their product n=p*q; n is called the modulus. Choose a number, called the encryption exponent e, less than n and relatively prime to (p−1)*(q−1), which means e and (p−1)*(q−1) have no common factors except 1. Find another number, called the decryption exponent d, such that (e*d−1) is divisible by (p−1)*(q−1). The values e and d are also called the public and private exponents, respectively. The public key is the pair (n, e) and the private key is the exponent d. The factors p and q may be destroyed or kept with the private key.
Encryption and decryption may be performed as follows. Suppose Alice wants to send a plaintext message m (0≦m≦n−1) to Bob. Alice creates the ciphertext message c (0≦c≦n−1) by exponentiating c=me mod n, where e and n are Bob's public key. She sends c to Bob. To decrypt, Bob exponentiates m=cd mod n; the relationship between e and d ensures that Bob correctly recovers m. Since only Bob knows d, only Bob can decrypt this message.
RSA is also commonly used to exchange a symmetric key. A symmetric key may be used to encrypt data. The symmetric key may then be encrypted by a sender using the receiver's public key. In this usage, the message m is a specific formatting of the symmetric key. Once the receiver receives and decrypts the symmetric key, the receiver can then use the symmetric key to decrypt the data.
It is currently very difficult to obtain a private key d from the public key (n, e). However, if one could factor n into p and q, then one could obtain the private key d. Thus, the security of the RSA system is based on the assumption that such factoring is difficult.
Other attacks on the RSA system have been attempted. In some sophisticated attack scenarios, d may inferred from information gathered from observing a processing system performing the modular exponentiation operation used in decryption. In these scenarios, observing memory access patterns, cache line accesses, and/or branches taken in executing code within the processing system may give the attacker sufficient information to deduce the private key. Hence, obscuring cryptographic computations such that observation of the memory access patterns, cache line accesses, and/or branches taken in executing code while performing the computations provides no meaningful information to an attacker is desirable.